This Red Hat security advisory addresses several vulnerabilities in Mozilla Thunderbird related to Firefox components. The fixed issues include memory safety bugs (CVE-2025-11714, CVE-2025-11715), out-of-bounds read/write triggered by WebGL textures in a privileged process (CVE-2025-11709), cross-process information leakage via malicious IPC messages (CVE-2025-11710), a use-after-free in MediaTrackGraphImpl::GetInstance() (CVE-2025-11708), an OBJECT tag type attribute that overrides browser behavior on web resources without a content-type (CVE-2025-11712), and modification of some non-writable object properties (CVE-2025-11711). These issues are fixed in Thunderbird ESR 140.4 and Thunderbird 144. The advisory is for Red Hat Enterprise Linux 8.4 Extended Update Support and AUS versions. The vendor has released updated packages to remediate these vulnerabilities.

The vulnerabilities collectively could allow memory corruption, out-of-bounds memory access, information leakage between processes, and unauthorized modification of object properties within Thunderbird. These issues may lead to potential security risks such as application crashes, privilege escalation, or data exposure. However, no known exploits in the wild have been reported. The overall security impact is rated as important/high severity by Red Hat.

Red Hat has released updated Thunderbird packages (version 140.4.0-2.el8_4 and corresponding ESR 140.4) that address these vulnerabilities. Users of affected Red Hat Enterprise Linux 8.4 Extended Update Support and AUS versions should apply the security update promptly. For detailed update instructions, refer to the Red Hat advisory at https://access.redhat.com/articles/11258. No additional mitigations are indicated by the vendor advisory.